Build on the records your team already uses.
A REST API and an MCP server for other AI tools, both in development, and webhooks through Automation today. A key can do no more than the person who owns it.
Webhooks in Automation are built. The public API and MCP connector are in development; API keys work only with the CyrilSites CLI today.
# In development: overdue invoices, as the key’s owner curl "https://app.getcyril.com/api/finance/invoices?status=overdue&limit=2" \ -H "Authorization: Bearer $CYRIL_API_KEY" { "data": [ { "number": "ROWA-0998", "status": "overdue", "currency": "USD", "total": "50595.00", "amountPaid": "0.00" }, { "number": "ROWA-0997", "status": "overdue", "currency": "USD", "total": "5272.00", "amountPaid": "0.00" } ], "meta": { "page": 1, "limit": 2, "total": 2, "totalPages": 1 } }
# In development: what can I call, and what does each tool need? curl "$CYRIL_MCP_URL/" # Search across Cyril as the key’s owner. # Records they can’t see are simply not returned. curl -X POST "$CYRIL_MCP_URL/tools/call" \ -H "X-API-Key: $CYRIL_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "tool": "search_cyril", "input": { "query": "Kestrel", "entityTypes": ["project", "ticket", "invoice"] } }'
One set of permissions, whoever is calling.
A key belongs to the person who created it and can do no more than they can. Today keys work with the CyrilSites command-line tool; the public API and MCP server that will use them are in development.
API key- Reads and edits invoices
- Reads companies and contacts
- No access to HR records
- Can’t delete anything
403.A REST API with no surprises.
In development: the same API the Cyril app is built on, opened to your API keys. Predictable paths, one response shape and errors you can act on.
- An interactive referenceCovers the core account, billing, product and file endpoints today, opened from Settings under API keys. More apps are being added.
- Keys you controlCreate, scope and revoke keys per organisation. Per-key rate limits and expiry are not built yet.
- One path per resourceNested by app, like
/api/projects/tasks. A retired endpoint answers410and names its replacement. - Lists that page the same wayEvery list takes
pageandlimit, up to 100 at a time, and says how many there are. - A sandbox to build againstSpin up a separate sandbox organisation and test without touching live records.
Errors Every error has the same shape
| Status | Code | When |
|---|---|---|
| 400 | VALIDATION_ERROR | A field failed validation. The message names it. |
| 401 | UNAUTHORIZED | The key is missing, invalid or revoked. |
| 403 | FORBIDDEN | The key is fine; its person isn’t allowed. |
| 404 | NOT_FOUND | Doesn’t exist, or belongs to another organisation. |
| 409 | CONFLICT | A duplicate, like an email already registered. |
| 410 | GONE | Retired. The message names the replacement. |
| 422 | UNPROCESSABLE | Valid, but breaks a business rule. |
| 429 | RATE_LIMITED | Slow down and retry. |
{ "error": "Cannot delete the last organisation owner",
"code": "UNPROCESSABLE" }Let other AI tools work with Cyril.
In development. The Cyril tools it will offer are written; connecting from assistants that speak the Model Context Protocol is not available yet.
SalesCompanies, contacts, deals
- list_companies
- read_company
- list_contacts
- read_contact
- list_deals
- read_deal
- search_sales
- create_contact
- update_deal
- log_activity
- send_email
FinanceInvoices, estimates
- list_invoices
- read_invoice
- list_estimates
- read_estimate
- create_invoice
- create_estimate
ProjectsProjects, tasks
- list_projects
- read_project
- list_tasks
- read_task
- create_task
- update_task_status
SupportTickets, help centre
- list_tickets
- read_ticket
- search_kb
- create_ticket
Docs and toolsSpaces, custom tools
- list_doc_spaces
- read_doc_space
- list_custom_tools
- read_custom_tool
EverywhereOne search
- search_cyril
ReadsCreates and updatesA selection of the tools written so far.
- Nothing destructive
- There is no delete tool. Removing records stays with people, in Cyril.
- Rules up front
- Each tool says which permission it needs and whether it needs approval, before anyone calls it.
- Changes recorded
- Changes made through a key are recorded in the audit log against the person who owns it.
POST https://ops.rowanhill.example/hooks/paid
{ "trigger": "invoice.paid",
"payload": {
"invoiceId": "…",
"amount": "66631.00" },
"timestamp": "…" }Webhooks, without writing a server.
In Automation, any rule can end by sending a webhook to a URL you choose, carrying the event that triggered it. An incoming webhook can start a rule, too.
Rules run on the same records and the same permissions as everything else. More on Automation.
Or skip the code.
In development: describe the tool you need and Cyril drafts it on sample data, reviewed before it goes live. A calculator, a report or a small internal app, inside Cyril.
Build your ownWhat’s ready.
Built means it exists and is tested today. It opens to you when your organisation gets early access. The full list is on what’s ready today.
- REST APIAccess with your own API keys, in development
- Not yet
- API referenceInteractive; core account, billing, product and file endpoints
- Built
- API keysScoped, revocable; CyrilSites CLI only today
- Built
- Sandbox organisationA separate tenant for testing
- Built
- MCP serverTools written; MCP clients can’t connect yet
- Not yet
- Webhooks in AutomationOutgoing actions and incoming triggers
- Built
- Custom tools that write to your recordsTools built in Cyril will only read at first; writing back comes later
- Not yet
Get a key when your place opens.
Cyril opens to founding members first. They keep their price and get help moving in, integrations included.
One email when your place opens. Nothing else.
